Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond

What happens when a threat model has to account for patient privacy and clinical harm as well as attackers? Bill Dougherty joins Chris and Robert to explain INCLUDES NO DIRT, the model he developed with Patrick Curry at Omada Health. They discuss why conventional security categories did not fully capture digital healthcare's competing security, privacy, and compliance needs, and how combining ideas from existing frameworks produced a memorable checklist. Bill walks through the practical workflow, from understanding a system and drawing data flows to asking targeted questions and prioritizing deeper review. The conversation also covers training product teams to use the model themselves, avoiding checkbox risk assessments, and adapting the published questionnaires to the risks an organization actually needs to understand.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Bill Dougherty:→ LinkedIn→ INCLUDES NO DIRT at Omada HealthMentioned in this episode:→ LINDDUN privacy threat modeling→ Microsoft threat modelingFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Introduction02:17 Bill's path into security leadership04:21 Security responsibilities at Omada Health06:38 Why digital healthcare needed another threat model10:20 The INCLUDES NO DIRT acronym11:09 Security, privacy, and clinical threat categories12:33 What makes healthcare different14:07 Turning the categories into a practical process18:21 Diagrams and understanding the system21:08 Applying the checklist to data flows23:35 Helping product teams become self-sufficient25:11 Requirements and compliance considerations27:00 Getting started with the questionnaires30:07 Closing thoughts